Telnyx

• Risk level: Medium
• Analyzed: May 10, 2026, 5:12 PM
• Findings: 2
• Version: 1.0.4

Overview

This Telnyx skill appears purpose-related, but it involves purchase-capable and sensitive account access that is broader and less clearly declared than the short description suggests.

Treat this as a powerful Telnyx account-management integration. Before installing, confirm how Membrane/Telnyx credentials are granted, use the narrowest available permissions, and require explicit approval for purchases, number orders, porting, payment changes, API key changes, MFA changes, and other account-level operations.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI02: Tool Misuse and Exploitation

Concern

What this means

If used too broadly, the agent could make costly or sensitive Telnyx account changes, such as ordering numbers or affecting account/payment/security settings.

Why it was flagged

These Telnyx resources can involve purchases, billing, account security, or account-level changes, but the provided artifact does not show clear approval gates or bounded workflows for such high-impact actions.

Skill content

Telnyx Overview ... **Number Order** ... **Porting Order** ... **Payment Method** ... **API Key** ... **MFA Settings** ... **Balance**

Recommendation

Only use this skill for explicit Telnyx tasks, and require manual confirmation before purchases, porting, payment changes, API key changes, MFA changes, or other account-security actions.

ASI03: Identity and Privilege Abuse

Concern

What this means

Users may not realize what account authority or credentials the skill needs before enabling it.

Why it was flagged

The registry declarations say no credential is required, while the capability signals indicate OAuth or sensitive credentials are needed, creating an unclear credential boundary for a privileged Telnyx integration.

Skill content

Required env vars: none; Primary credential: none ... Capability signals: requires-oauth-token, requires-sensitive-credentials

Recommendation

Clarify the credential flow and requested Telnyx scopes before installation; prefer least-privilege tokens and revoke access if the skill is no longer needed.